GHSA-2v8p-3f2j-5mp7 CVE-2026-71436
Mermaid XY Charts are vulnerable to an infinite loop DoS
- Severity
- 5.3 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 0.58%
- Chance of exploitation in the next 30 days. Higher than 47.79% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- CWE-1325 Improperly Controlled Sequential Memory Allocation
- Fix
10.9.8- Upgrade mermaid to this version or later
Description
Impact
Mermaid XY Charts are vulnerable to an infinite loop DoS attack in the setXAxisRangeData(), when configuring an X-Axis with invalid parameters.
As each loop appends an element to an array, this would generally only cause an RangeError: Invalid array length to appear after a few seconds, but may cause the page/JavaScript process to crash due to memory exhaustion, depending on the environment.
Proof-of-concept
xychart
x-axis 1 --> 1
line [1, 2]
Patches
This has been patched in https://github.com/mermaid-js/mermaid/commit/630aa7e5dd417e1f56bff2a1ce8df2c5ad08d289 and released in Mermaid v11.16.1.
A backport has been made for the v10 branch in ef60adc837d9d5107af21285f01e83dea309bd0a and was released in Mermaid v10.9.8
Workarounds
There are no known workarounds. Please update to the latest version or apply the patch.
References
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| mermaid | >= 10.6.0, < 10.9.8 |
10.9.8 |
| mermaid | >= 11.0.0-alpha.1, < 11.16.1 |
11.16.1 |
| mermaid | >= 10.6.0, < 10.9.8 |
10.9.8 |
| mermaid | >= 11.0.0-alpha.1, < 11.16.1 |
11.16.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
mermaid npm → 10.9.8
- npm
npm install mermaid@10.9.8- yarn
yarn add mermaid@10.9.8- pnpm
pnpm add mermaid@10.9.8
Severity breakdown
CVSS 4.0 5.3
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- Passive
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- Low
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- Low
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-1325: Improperly Controlled Sequential Memory Allocation
The product manages a group of objects or resources and performs a separate memory allocation for each object, but it does not properly limit the total amount of memory that is consumed by all of the combined objects.
How to prevent it
- Implementation: Ensure multiple allocations of the same kind of object are properly tracked - possibly across multiple sessions, requests, or messages. Define an appropriate strategy for handling requests that exceed the limit, and consider supporting a configuration option so that the administrator can extend the amount of memory to be used if necessary.
- Operation: Run the program using system-provided resource limits for memory. This might still cause the program to crash or exit, but the impact to the rest of the system will be minimized.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-rhh3-jpg6-66xh Mermaid radar diagrams are vulnerable to DoS | Medium | Also affects mermaid |
| GHSA-c4c3-pg64-4m4v Mermaid configuration APIs allow prototype pollution | Low | Also affects mermaid |
| GHSA-6x64-9x62-f2gx Mermaid allows CSS injection applying to sibling elements of the diagram | Medium | Also affects mermaid |
| GHSA-3rrr-jr9j-h3q3 Mermaid Architecture diagrams are vulnerable to prototype pollution | Medium | Also affects mermaid |
| GHSA-87f9-hvmw-gh4p Mermaid: Improper sanitization of configuration leads to CSS injection | Medium | Also affects mermaid |
| GHSA-6m6c-36f7-fhxh Mermaid Gantt Charts are vulnerable to an Infinite Loop DoS | Medium | Also affects mermaid |
| GHSA-ghcm-xqfw-q4vr Mermaid: Improper sanitization of `classDef` in state diagrams leads to HTML injection | Medium | Also affects mermaid |
| GHSA-xcj9-5m2h-648r Mermaid: Improper sanitization of `classDefs` in diagrams leads to CSS injection | Medium | Also affects mermaid |
Credits: aloisklink
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor